83a52bef36eaaaeabacc363297a5fbecc76ccd026e491e6b291c92ac63580ec8

Sharing

Copy URL Twitter E-mail

General

Target
83a52bef36eaaaeabacc363297a5fbecc76ccd026e491e6b291c92ac63580ec8
Size 473KB
Sample260822-lj9bhsshrc
SHA256 83a52bef36eaaaeabacc363297a5fbecc76ccd026e491e6b291c92ac63580ec8
MD5 f5de19ae6d3ad78999411e9857d5109b
SHA1 5df6eff017bb6437623b31fd58e5c6a578dd5056
SHA512 e095d76ad9d5018fe4ae717b7e4f1b411977f7a907cb82bbea6012343cfd4bc5a14379f2753f845429e338e21a8545c10ceae256e1449ad44cdaacf48bee3786
SSDEEP 12288:SkVziuWd0x7LSB6JPoIwkt5Lonz732M5uG:S0pRx7GMbw4onz7Gs
TLSH
T1ADA49E81F1E805E8D477D07C919BBA1BE539342807108ADB73E8E5292FF37E46AB6711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
83a52bef36eaaaeabacc363297a5fbecc76ccd026e491e6b291c92ac63580ec8

File Explorer

83a52bef36eaaaeabacc363297a5fbecc76ccd026e491e6b291c92ac63580ec8

.exe 473KB

83a52bef36eaaaeabacc363297a5fbecc76ccd026e491e6b291c92ac63580ec8

IMPHASH 46cc7806b78ea0a12cba6ebf87211fa7
SHA256 83a52bef36eaaaeabacc363297a5fbecc76ccd026e491e6b291c92ac63580ec8
MD5 f5de19ae6d3ad78999411e9857d5109b
SHA1 5df6eff017bb6437623b31fd58e5c6a578dd5056
SHA512 e095d76ad9d5018fe4ae717b7e4f1b411977f7a907cb82bbea6012343cfd4bc5a14379f2753f845429e338e21a8545c10ceae256e1449ad44cdaacf48bee3786
SSDEEP 12288:SkVziuWd0x7LSB6JPoIwkt5Lonz732M5uG:S0pRx7GMbw4onz7Gs
TLSH
T1ADA49E81F1E805E8D477D07C919BBA1BE539342807108ADB73E8E5292FF37E46AB6711
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

368352

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

wpcap

pcap_freealldevs pcap_open pcap_sendqueue_transmit pcap_sendqueue_queue pcap_sendqueue_destroy pcap_sendqueue_alloc pcap_geterr pcap_sendpacket pcap_close pcap_findalldevs

d3d11

D3D11CreateDevice D3D11CreateDeviceAndSwapChain

dxgi

CreateDXGIFactory1

ws2_32

WSAStartup inet_addr htons WSACleanup htonl

user32

ScreenToClient ClientToScreen GetCursorPos SetCursor SetCursorPos GetClientRect GetForegroundWindow IsWindowUnicode ReleaseCapture SetCapture GetCapture GetKeyState GetMessageExtraInfo TrackMouseEvent GetKeyboardLayout EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard LoadIconW UpdateWindow ShowWindow DestroyWindow CreateWindowExW RegisterClassExW UnregisterClassW TranslateMessage PostQuitMessage DefWindowProcW SendMessageW PeekMessageA DispatchMessageA LoadCursorA

crypt32

CryptUnprotectData CryptProtectData

shell32

CommandLineToArgvW SHGetFolderPathW ShellExecuteA

kernel32

RtlVirtualUnwind RtlLookupFunctionEntry UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent InitializeSListHead GetStartupInfoW GetModuleHandleW GetLocaleInfoA LoadLibraryA GetCurrentProcessId FreeLibrary MultiByteToWideChar GlobalFree GlobalLock GlobalUnlock GlobalAlloc WideCharToMultiByte CreateDirectoryW GetModuleHandleA DeleteCriticalSection CloseHandle GetSystemTimePreciseAsFileTime GetLocalTime SetThreadPriority GetCurrentThread CreateThread Sleep CreateWaitableTimerExW SetWaitableTimer WaitForSingleObject LeaveCriticalSection EnterCriticalSection InitializeCriticalSection QueryPerformanceFrequency QueryPerformanceCounter CreateDirectoryA GetEnvironmentVariableA lstrcmpiW LocalFree GetCurrentThreadId GetSystemTimeAsFileTime GetProcAddress GetCommandLineW RtlCaptureContext

msvcp140

?_Xlength_error@std@@YAXPEBD@Z

iphlpapi

SendARP GetAdaptersInfo

imm32

ImmSetCandidateWindow ImmSetCompositionWindow ImmReleaseContext ImmGetContext

d3dcompiler_47

D3DCompile

vcruntime140

strstr __current_exception_context __current_exception __C_specific_handler memchr __std_terminate memcpy memset __std_exception_copy __std_exception_destroy _CxxThrowException strchr memcmp memmove

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsscanf fopen fclose ftell fseek fflush _wfopen __p__commode _ftelli64 _fseeki64 fread fopen_s __stdio_common_vswprintf __stdio_common_vfprintf __stdio_common_vsprintf __acrt_iob_func _set_fmode fwrite

api-ms-win-crt-heap-l1-1-0

realloc free _callnewh _set_new_mode malloc

api-ms-win-crt-runtime-l1-1-0

_initialize_wide_environment _seh_filter_exe terminate _cexit _crt_atexit _get_wide_winmain_command_line _initterm _initterm_e exit _exit _c_exit _register_onexit_function _register_thread_local_exe_atexit_callback _configure_wide_argv _set_app_type _invoke_watson _initialize_onexit_table

api-ms-win-crt-string-l1-1-0

strcmp strlen strtok_s strncpy strncmp strcpy_s

api-ms-win-crt-math-l1-1-0

sinf log pow ceilf floorf acosf powf sqrtf fmodf cosf logf __setusermatherr

api-ms-win-crt-convert-l1-1-0

atoi atof

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

83a52bef36eaaaeabacc363297a5fbecc76ccd026e491e6b291c92ac63580ec8

wpcap

d3d11

dxgi

ws2_32

user32

crypt32

shell32

kernel32

msvcp140

iphlpapi

imm32

d3dcompiler_47

vcruntime140

vcruntime140_1

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic